# Move to Full (strict)

> Switch an existing zone or one name from Full to Full (strict) without 526 errors, using the origin status to check first.

New zones start in Full (strict). Older zones may still be in Full, where the edge encrypts but accepts any origin certificate. This guide switches them safely: check first, fix what would fail, then switch.

## Check the origin status

The origin status shows, for every proxied HTTPS name, what the edge would find with Full (strict). It's measured with a TLS handshake only (no HTTP request), takes at most 5 seconds per origin and is cached for 60 seconds per zone.

**Dashboard**

Go to **SSL/TLS › Origin › Origin status** and select **Check again**.

**CLI**

```sh
openwaf-cloud ctl origin-tls status example.com
```

**API**

```sh
curl -s https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/origin-tls/status \
  -H "Authorization: Bearer $OPENWAF_TOKEN"
```

**MCP**

`origin_tls_status` with `{"zone": "example.com"}`.


Each name has a `probe.state`:

| State | Dashboard | Meaning |
|---|---|---|
| `ok` | OK | The certificate would pass Full (strict). `trusted_by` says whether a `public` CA or the `origin_ca` vouches for it. |
| `invalid` | Invalid certificate | It would fail; `error` says why (expired, name mismatch, unknown authority, revoked). Marked *Would fail with Full (strict) (526)*. |
| `unreachable` | Unreachable | The check couldn't connect. |
| `http` | HTTP (not encrypted) | The origin uses `http`; TLS modes don't apply. |
| `skipped` | Not checked | The origin resolves to a private, loopback or link-local address, which the check never connects to. |

The status also shows each name's mode, `effective_server_name` (the name that would be verified), whether the origin asks for a client certificate, the certificate's expiry, and the edge's `525`/`526` errors in the last 24 hours with the latest one.

> **Note**
>
> The check runs from the OpenWAF control plane, not from the edge. An origin that only accepts connections from the edge can show `unreachable` even though the edge reaches it; look at the edge errors column then.


## Switch safely

1. **Fix every name that isn't `ok`.** Install a certificate from a public CA or a free [OpenWAF Origin CA certificate](https://developers.openwaf.dev/ssl/origin-ca/). If the certificate is for a different name than the verified one, set `origin.server_name` (**SSL/TLS › Origin › Advanced › Origin TLS name (SNI)**).
2. **Check again** until every name you are switching is `ok`.
3. **Switch the mode**, for the whole zone or one name first.

**Dashboard**

   In **SSL/TLS › Origin › Origin encryption**, choose **Full (strict)**. Use **Scope** to apply it to the whole domain or to a single name, then **Save changes** with a reason.

**CLI**

   ```sh
   # Whole zone:
   openwaf-cloud ctl zones set example.com origin.tls_verify=full_strict --reason "origin has a valid certificate"
   # One name only:
   openwaf-cloud ctl zones set example.com --host www.example.com origin.tls_verify=full_strict --reason "www first"
   ```

**API**

   ```sh
   curl -s -X PATCH https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/edge \
     -H "Authorization: Bearer $OPENWAF_TOKEN" \
     -H "Content-Type: application/json" \
     -H "X-Change-Reason: origin has a valid certificate" \
     -d '{"origin": {"tls_verify": "full_strict"}}'
   ```

   For one name: `{"hosts": {"www.example.com": {"origin": {"tls_verify": "full_strict"}}}}`. Add `?dry_run=1` to see the change without applying it.

**MCP**

   `update_settings` simulates with `confirm=false` and returns the diff and `current_version`; repeat with `confirm=true` and `expected_version`.

   ```json
   {"zone": "example.com", "settings": {"origin": {"tls_verify": "full_strict"}}, "reason": "origin has a valid certificate", "confirm": false}
   ```


4. **Watch for 526 errors** in the origin status (errors in the last 24 hours) or in [security events](https://developers.openwaf.dev/analytics/security-events/). If something breaks, switch back to `full` or revert the zone version.


## Related

- [Origin TLS modes](https://developers.openwaf.dev/ssl/origin-tls/)
- [Troubleshooting 526](https://developers.openwaf.dev/ssl/troubleshooting/#error-526)